1

I'm looking to find (or otherwise establish) an authoritative list of Data URL Safe characters in 2020.

I've found older references on the web regarding which characters may or may not be Data URL Safe, most notably this one from late 2012:

but I'm guessing it may be a little out of date given that it recommends encoding spaces and commas (?) and I'm fairly certain that these are both fairly safe to include in a Data URL today. (Although I may be wrong about this...)

Here is my current list of Data URL Safe characters:

  • A-Z
  • a-z
  • 0-9
  • .
  • ,
  • ;
  • :
  • /
  • _
  • =
  • -
  • ~
  • '
  • [space]

Are there any more Data URL Safe characters which ought to be on the list above but aren't?

Conversely, are there any characters on the list above which really are not safe to be included in a Data URL?

4
  • What makes you think that RFC3986 section 3 pretty-rfc.herokuapp.com/RFC3986 isn't current? – Steve Dec 3 '20 at 1:02
  • 1
    A list of allowed characters is explained there. Why aren't you using that as your reference instead of asking people's opinions? – Steve Dec 3 '20 at 1:08
  • @Steve - I'm not seeing the list of allowed characters you are referring to. Please can you give the closest sub-heading in the document? Thanks. – Rounin Dec 3 '20 at 1:10
  • Section 3 synopsis inc 3.2 - it includes the statement "A URI is composed from a limited set of characters consisting of digits, letters, and a few graphic symbols." and – Steve Dec 3 '20 at 1:29
1

RFC 2397 - The "data" URL scheme says what characters are allowed in Data URIs:

data       := *urlchar

where "urlchar" is imported from RFC2396

RFC 2396 has been obsoleted by RFC 3986 - Uniform Resource Identifier (URI): Generic Syntax so that should be consulted. Unfortunately, it doesn't actually define "urlchars". It says that the characters available for unreserved use within URIs are:

unreserved  = ALPHA / DIGIT / "-" / "." / "_" / "~"

And the characters may be used in URIs but which are reserved as delimeters with special meaning are:

 reserved    = gen-delims / sub-delims
 gen-delims  = ":" / "/" / "?" / "#" / "[" / "]" / "@"
 sub-delims  = "!" / "$" / "&" / "'" / "(" / ")"
               / "*" / "+" / "," / ";" / "="

It appears that when RFC 2397 says "urlchars" it means both the "reserved" and "unreserved" characters. Wikipedia says:

Note that this may include characters, such as colon, semicolon, and comma which are delimiters in the URI components preceding the data part.

The list you started with erroneously includes [space] which is not listed anywhere as a URI character. Your list does not include several of the punctuation symbols which are all allowed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.